Cloud Functions vs Cloud Run

import functions_framework
from google.cloud import storage, vision

@functions_framework.cloud_event
def process_image(cloud_event):
    """Triggered by a Cloud Storage upload event."""
    data = cloud_event.data
    bucket_name = data["bucket"]
    file_name = data["name"]

    if not file_name.lower().endswith(('.png', '.jpg', '.jpeg')):
        print(f"Skipping non-image file: {file_name}")
        return

    # Run Vision API label detection
    client = vision.ImageAnnotatorClient()
    image = vision.Image(
        source=vision.ImageSource(
            gcs_image_uri=f"gs://{bucket_name}/{file_name}"
        )
    )
    response = client.label_detection(image=image)
    labels = [label.description for label in response.label_annotations]

    # Store labels as metadata on the object
    storage_client = storage.Client()
    blob = storage_client.bucket(bucket_name).blob(file_name)
    blob.metadata = {"labels": ",".join(labels)}
    blob.patch()

    print(f"Labeled {file_name}: {labels}")

gcloud functions deploy process-image \
  --gen2 \
  --runtime=python312 \
  --region=us-central1 \
  --source=. \
  --entry-point=process_image \
  --trigger-event-filters="type=google.cloud.storage.object.v1.finalized" \
  --trigger-event-filters="bucket=my-image-bucket" \
  --memory=512Mi \
  --timeout=120s \
  --max-instances=100 \
  --service-account=image-processor@my-project.iam.gserviceaccount.com

import functions_framework
import json
import base64
from google.cloud import bigquery

@functions_framework.cloud_event
def process_event(cloud_event):
    """Process events from Pub/Sub and write to BigQuery."""
    # Decode the Pub/Sub message
    message_data = base64.b64decode(
        cloud_event.data["message"]["data"]
    ).decode("utf-8")
    event = json.loads(message_data)

    # Transform and load into BigQuery
    client = bigquery.Client()
    table_id = "my-project.analytics.events"

    rows = [{
        "event_type": event["type"],
        "user_id": event.get("user_id"),
        "timestamp": event["timestamp"],
        "properties": json.dumps(event.get("properties", {})),
    }]

    errors = client.insert_rows_json(table_id, rows)
    if errors:
        raise RuntimeError(f"BigQuery insert errors: {errors}")

    print(f"Inserted event: {event['type']}")

gcloud functions deploy process-event \
  --gen2 \
  --runtime=python312 \
  --region=us-central1 \
  --source=. \
  --entry-point=process_event \
  --trigger-topic=analytics-events \
  --memory=256Mi \
  --timeout=60s \
  --max-instances=500 \
  --retry \
  --service-account=event-processor@my-project.iam.gserviceaccount.com

FROM python:3.12-slim

WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

# Cloud Run injects the PORT environment variable
ENV PORT=8080
EXPOSE 8080

CMD ["gunicorn", "--bind", "0.0.0.0:8080", "--workers", "2", "--threads", "8", "app:create_app()"]

# Build and push the container image
gcloud builds submit --tag us-docker.pkg.dev/my-project/my-repo/api-service:v2

# Deploy with no traffic (canary preparation)
gcloud run deploy api-service \
  --image=us-docker.pkg.dev/my-project/my-repo/api-service:v2 \
  --region=us-central1 \
  --memory=1Gi \
  --cpu=2 \
  --concurrency=80 \
  --min-instances=2 \
  --max-instances=100 \
  --no-traffic \
  --service-account=api-service@my-project.iam.gserviceaccount.com

# Gradually shift traffic: 10% to new revision
gcloud run services update-traffic api-service \
  --region=us-central1 \
  --to-revisions=LATEST=10

# Monitor error rates in Cloud Monitoring, then shift 100%
gcloud run services update-traffic api-service \
  --region=us-central1 \
  --to-revisions=LATEST=100

apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: my-api
  annotations:
    run.googleapis.com/launch-stage: BETA
spec:
  template:
    metadata:
      annotations:
        run.googleapis.com/container-dependencies: '{"api":["otel-collector"]}'
    spec:
      containers:
        - name: api
          image: us-docker.pkg.dev/my-project/my-repo/api:v1
          ports:
            - containerPort: 8080
          env:
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: http://localhost:4317
          resources:
            limits:
              memory: 1Gi
              cpu: "2"
        - name: otel-collector
          image: otel/opentelemetry-collector-contrib:latest
          env:
            - name: GOOGLE_CLOUD_PROJECT
              value: my-project
          resources:
            limits:
              memory: 256Mi
              cpu: "0.5"

# Create a job for nightly data processing
gcloud run jobs create nightly-etl \
  --image=us-docker.pkg.dev/my-project/my-repo/etl:v1 \
  --region=us-central1 \
  --memory=4Gi \
  --cpu=4 \
  --task-timeout=3600 \
  --max-retries=3 \
  --parallelism=10 \
  --tasks=10 \
  --service-account=etl-processor@my-project.iam.gserviceaccount.com \
  --set-env-vars="BATCH_SIZE=10000"

# Execute the job
gcloud run jobs execute nightly-etl --region=us-central1

# Schedule the job with Cloud Scheduler
gcloud scheduler jobs create http nightly-etl-trigger \
  --schedule="0 2 * * *" \
  --time-zone="America/Chicago" \
  --uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/my-project/jobs/nightly-etl:run" \
  --http-method=POST \
  --oauth-service-account-email=scheduler@my-project.iam.gserviceaccount.com \
  --location=us-central1

# Deploy Cloud Run with Direct VPC Egress
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1 \
  --region=us-central1 \
  --network=prod-vpc \
  --subnet=prod-us-central1 \
  --vpc-egress=private-ranges-only \
  --service-account=api@my-project.iam.gserviceaccount.com

# For Cloud Functions with Direct VPC Egress
gcloud functions deploy my-function \
  --gen2 \
  --runtime=python312 \
  --region=us-central1 \
  --source=. \
  --entry-point=handler \
  --trigger-http \
  --network=projects/my-project/global/networks/prod-vpc \
  --subnet=projects/my-project/regions/us-central1/subnetworks/prod-us-central1 \
  --egress-settings=private-ranges-only

# Calculate monthly cost for a Cloud Run API:
# - 10M requests/month
# - Average response time: 200ms
# - Concurrency: 80
# - 2 vCPU, 1 GB memory
# - 2 min instances (warm)

# Active instance cost:
# Effective instance-seconds = 10M requests * 0.2s / 80 concurrency = 25,000 seconds
# vCPU cost: 25,000 * 2 vCPU * $0.0000240 = $1.20
# Memory cost: 25,000 * 1 GB * $0.0000025 = $0.06

# Min instances idle cost (2 instances * ~2.5M seconds/month):
# vCPU idle cost: 5,000,000 * 2 * $0.0000025 = $25.00
# Memory idle cost: 5,000,000 * 1 * $0.0000003 = $1.50

# Total: ~$28/month for 10M requests
# Compare to Cloud Functions: 10M * $0.40/M + compute = ~$80-120/month

# Deploy with startup CPU boost for faster cold starts
gcloud run deploy my-api \
  --image=us-docker.pkg.dev/my-project/my-repo/api:v1 \
  --region=us-central1 \
  --cpu-boost \
  --min-instances=1 \
  --execution-environment=gen2

# Deploy an internal-only service
gcloud run deploy backend-api \
  --image=us-docker.pkg.dev/my-project/my-repo/backend:v1 \
  --region=us-central1 \
  --no-allow-unauthenticated \
  --service-account=backend@my-project.iam.gserviceaccount.com \
  --set-secrets="DB_PASSWORD=db-password:latest,API_KEY=api-key:latest" \
  --ingress=internal

# Grant the frontend service account permission to invoke the backend
gcloud run services add-iam-policy-binding backend-api \
  --region=us-central1 \
  --member="serviceAccount:frontend@my-project.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

# Create an alert for high error rate
gcloud monitoring policies create \
  --notification-channels=CHANNEL_ID \
  --display-name="Cloud Run High Error Rate" \
  --condition-display-name="5xx error rate > 1%" \
  --condition-filter='resource.type="cloud_run_revision" AND metric.type="run.googleapis.com/request_count" AND metric.labels.response_code_class="5xx"' \
  --condition-threshold-value=0.01 \
  --condition-threshold-comparison=COMPARISON_GT \
  --aggregation-alignment-period=300s \
  --aggregation-per-series-aligner=ALIGN_RATE

# Create an alert for high latency
gcloud monitoring policies create \
  --notification-channels=CHANNEL_ID \
  --display-name="Cloud Run High Latency" \
  --condition-display-name="p99 latency > 2 seconds" \
  --condition-filter='resource.type="cloud_run_revision" AND metric.type="run.googleapis.com/request_latencies"' \
  --condition-threshold-value=2000 \
  --condition-threshold-comparison=COMPARISON_GT \
  --aggregation-alignment-period=300s \
  --aggregation-per-series-aligner=ALIGN_PERCENTILE_99